【fuzz】sleuthkit_fls_ext_fuzzer heap-buffer-overflow

【环境信息】
x86
【测试版本】
Name:           sleuthkit
Version:        4.6.7
Release:        2
【注意事项】
受影响版本排查（受影响/不受影响）
1、master
2、openEuler-LTS-20.03
3、openEuler-LTS-20.03-SP1
4、openEuler-LTS-20.03-Next
5、openEuler-20.09
①【测试步骤】
1、编译
python3 infra/helper.py build_fuzzers --sanitizer address sleuthkit
2、执行
python3 infra/helper.py run_fuzzer sleuthkit sleuthkit_fls_ext_fuzzer -rss_limit_mb=0
【报错信息】
```
==8==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000980 at pc 0x000000612a8d bp 0x7ffdb0273b40 sp 0x7ffdb0273b38
READ of size 1 at 0x619000000980 thread T0
SCARINESS: 12 (1-byte-read-heap-buffer-overflow)
    #0 0x612a8c in ext2fs_inode_walk /src/sleuthkit/tsk/fs/ext2fs.c:1057:20
    #1 0x55a7f3 in tsk_fs_meta_walk /src/sleuthkit/tsk/fs/fs_inode.c:197:12
    #2 0x556ad8 in tsk_fs_dir_find_orphans /src/sleuthkit/tsk/fs/fs_dir.c:1205:9
    #3 0x639993 in ext2fs_dir_open_meta /src/sleuthkit/tsk/fs/ext2fs_dent.c:298:16
    #4 0x55330a in tsk_fs_dir_open_meta /src/sleuthkit/tsk/fs/fs_dir.c:290:14
    #5 0x5545ce in tsk_fs_dir_walk_lcl /src/sleuthkit/tsk/fs/fs_dir.c:556:19
    #6 0x5555ef in tsk_fs_dir_walk_lcl /src/sleuthkit/tsk/fs/fs_dir.c:712:26
    #7 0x55441c in tsk_fs_dir_walk /src/sleuthkit/tsk/fs/fs_dir.c:817:14
    #8 0x550e57 in tsk_fs_fls /src/sleuthkit/tsk/fs/fls_lib.c:262:12
    #9 0x5508e8 in LLVMFuzzerTestOneInput /src/sleuthkit_fls_fuzzer.cc:35:5
    #10 0x4589c1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #11 0x443d22 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:296:6
    #12 0x449db7 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:776:9
    #13 0x472402 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #14 0x7fe886bdf82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #15 0x41e338 in _start (/out/sleuthkit_fls_ext_fuzzer+0x41e338)

0x619000000980 is located 0 bytes to the right of 1024-byte region [0x619000000580,0x619000000980)
allocated by thread T0 here:
    #0 0x51e07d in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x60ab49 in tsk_malloc /src/sleuthkit/tsk/base/mymalloc.c:32:16
    #2 0x612bef in ext2fs_imap_load /src/sleuthkit/tsk/fs/ext2fs.c:402:25
    #3 0x617d54 in ext2fs_dinode_copy /src/sleuthkit/tsk/fs/ext2fs.c:835:9
    #4 0x620fae in ext2fs_inode_lookup /src/sleuthkit/tsk/fs/ext2fs.c:913:9
    #5 0x5586cb in tsk_fs_file_open_meta /src/sleuthkit/tsk/fs/fs_file.c:128:9
    #6 0x6399ab in ext2fs_dir_open_meta /src/sleuthkit/tsk/fs/ext2fs_dent.c:309:13
    #7 0x55330a in tsk_fs_dir_open_meta /src/sleuthkit/tsk/fs/fs_dir.c:290:14
    #8 0x5545ce in tsk_fs_dir_walk_lcl /src/sleuthkit/tsk/fs/fs_dir.c:556:19
    #9 0x55441c in tsk_fs_dir_walk /src/sleuthkit/tsk/fs/fs_dir.c:817:14
    #10 0x550e57 in tsk_fs_fls /src/sleuthkit/tsk/fs/fls_lib.c:262:12
    #11 0x5508e8 in LLVMFuzzerTestOneInput /src/sleuthkit_fls_fuzzer.cc:35:5
    #12 0x4589c1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #13 0x443d22 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:296:6
    #14 0x449db7 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:776:9
    #15 0x472402 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #16 0x7fe886bdf82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /src/sleuthkit/tsk/fs/ext2fs.c:1057:20 in ext2fs_inode_walk
Shadow bytes around the buggy address:
  0x0c327fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff80f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c327fff8130:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff8160: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff8170: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff8180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==8==ABORTING
```
【问题复现】
python infra/helper.py reproduce sleuthkit sleuthkit_fls_ext_fuzzer crash-0f18becf637c8d5fe3a6a82d2d756aff7942df03

②【测试步骤】
1、编译
python3 infra/helper.py build_fuzzers --sanitizer address sleuthkit
2、执行
python3 infra/helper.py run_fuzzer sleuthkit sleuthkit_fls_hfs_fuzzer -rss_limit_mb=0
【报错信息】
```
==8==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000000d8 at pc 0x000000585d6d bp 0x7ffd346db910 sp 0x7ffd346db908
READ of size 1 at 0x6020000000d8 thread T0
SCARINESS: 12 (1-byte-read-heap-buffer-overflow)
    #0 0x585d6c in hfs_load_extended_attrs /src/sleuthkit/tsk/fs/hfs.c:4036:29
    #1 0x578277 in hfs_make_catalog /src/sleuthkit/tsk/fs/hfs.c:1932:14
    #2 0x565372 in hfs_inode_lookup /src/sleuthkit/tsk/fs/hfs.c:2561:16
    #3 0x5586cb in tsk_fs_file_open_meta /src/sleuthkit/tsk/fs/fs_file.c:128:9
    #4 0x567393 in hfs_open /src/sleuthkit/tsk/fs/hfs.c:6697:13
    #5 0x55e58d in tsk_fs_open_img /src/sleuthkit/tsk/fs/fs_open.c:172:16
    #6 0x5508a5 in LLVMFuzzerTestOneInput /src/sleuthkit_fls_fuzzer.cc:33:8
    #7 0x4589c1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #8 0x443d22 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:296:6
    #9 0x449db7 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:776:9
    #10 0x472402 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #11 0x7fef47e2982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #12 0x41e338 in _start (/out/sleuthkit_fls_hfs_fuzzer+0x41e338)

0x6020000000d8 is located 7 bytes to the right of 1-byte region [0x6020000000d0,0x6020000000d1)
allocated by thread T0 here:
    #0 0x51e07d in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x583215 in hfs_load_extended_attrs /src/sleuthkit/tsk/fs/hfs.c:3974:28
    #2 0x578277 in hfs_make_catalog /src/sleuthkit/tsk/fs/hfs.c:1932:14
    #3 0x565372 in hfs_inode_lookup /src/sleuthkit/tsk/fs/hfs.c:2561:16
    #4 0x5586cb in tsk_fs_file_open_meta /src/sleuthkit/tsk/fs/fs_file.c:128:9
    #5 0x567393 in hfs_open /src/sleuthkit/tsk/fs/hfs.c:6697:13
    #6 0x55e58d in tsk_fs_open_img /src/sleuthkit/tsk/fs/fs_open.c:172:16
    #7 0x5508a5 in LLVMFuzzerTestOneInput /src/sleuthkit_fls_fuzzer.cc:33:8
    #8 0x4589c1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #9 0x443d22 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:296:6
    #10 0x449db7 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:776:9
    #11 0x472402 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #12 0x7fef47e2982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /src/sleuthkit/tsk/fs/hfs.c:4036:29 in hfs_load_extended_attrs
Shadow bytes around the buggy address:
  0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff8000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa
=>0x0c047fff8010: fa fa 00 fa fa fa 00 fa fa fa 01[fa]fa fa fa fa
  0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==8==ABORTING
```
【问题复现】
python infra/helper.py reproduce sleuthkit sleuthkit_fls_ext_fuzzer crash-353d6e0352b6a12e0491d2ca6887885e0fca7ed4

③【测试步骤】
1、编译
python3 infra/helper.py build_fuzzers --sanitizer address sleuthkit
2、执行
python3 infra/helper.py run_fuzzer sleuthkit sleuthkit_fls_ntfs_fuzzer -rss_limit_mb=0
【报错信息】
```
==8==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000005e8c at pc 0x00000060f8ef bp 0x7ffd4049c330 sp 0x7ffd4049c328
READ of size 1 at 0x619000005e8c thread T0
SCARINESS: 22 (1-byte-read-heap-buffer-overflow-far-from-bounds)
    #0 0x60f8ee in tsk_UTF16toUTF8 /src/sleuthkit/tsk/base/tsk_unicode.c:159:14
    #1 0x5c2a52 in ntfs_proc_attrseq /src/sleuthkit/tsk/fs/ntfs.c:1795:17
    #2 0x5c170f in ntfs_dinode_copy /src/sleuthkit/tsk/fs/ntfs.c:2739:19
    #3 0x5aeb92 in ntfs_inode_lookup /src/sleuthkit/tsk/fs/ntfs.c:2840:9
    #4 0x5586cb in tsk_fs_file_open_meta /src/sleuthkit/tsk/fs/fs_file.c:128:9
    #5 0x5aba18 in ntfs_open /src/sleuthkit/tsk/fs/ntfs.c:5159:13
    #6 0x55e25b in tsk_fs_open_img /src/sleuthkit/tsk/fs/fs_open.c:160:16
    #7 0x5508a5 in LLVMFuzzerTestOneInput /src/sleuthkit_fls_fuzzer.cc:33:8
    #8 0x4589c1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #9 0x443d22 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:296:6
    #10 0x449db7 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:776:9
    #11 0x472402 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #12 0x7f79687b682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #13 0x41e338 in _start (/out/sleuthkit_fls_ntfs_fuzzer+0x41e338)

Address 0x619000005e8c is a wild pointer.
SUMMARY: AddressSanitizer: heap-buffer-overflow /src/sleuthkit/tsk/base/tsk_unicode.c:159:14 in tsk_UTF16toUTF8
Shadow bytes around the buggy address:
  0x0c327fff8b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c327fff8bd0: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8c10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8c20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==8==ABORTING
```
【问题复现】
python infra/helper.py reproduce sleuthkit sleuthkit_fls_ntfs_fuzzer crash-d309a85bfa999d775ad84c70e4ce1eb329eb7814

src-openEuler/sleuthkit

内容风险标识

评论 (4)

src-openEuler/sleuthkit .gitee-modal { width: 500px !important; }

内容风险标识